🤖 machine learning

Redefining Maritime Anomaly Detection via Equation-Grounded Synthetic Anomalies

This paper addresses the scarcity of labeled maritime anomaly data by proposing an equation-grounded taxonomy and a unified pipeline that synthesizes timestamp-level labeled anomalies, enabling a systematic evaluation of diverse detection models across single-vessel and inter-vessel scenarios.

Original authors: Youngseok Hwang, Sungho Bae, Dohun Lee, Jaeeun Seo, Jeehong Kim, Wonhee Lee, Hyunwoo Park

Published 2026-06-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Youngseok Hwang, Sungho Bae, Dohun Lee, Jaeeun Seo, Jeehong Kim, Wonhee Lee, Hyunwoo Park

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: Finding the "Bad Apples" in the Ocean

Imagine the ocean is a giant highway, and ships are cars driving on it. To keep everyone safe, we need to spot "bad drivers"—ships that are doing something dangerous, like swerving wildly, stopping in the middle of the road, or driving too close to another car.

The data we use to watch these ships is called AIS (Automatic Identification System). It's like a GPS tracker that every ship broadcasts.

The Problem:
The problem is that the public maps of this traffic don't have "red flags" on the bad drivers. We don't know which ships are actually in trouble.

Old way: Researchers tried to guess by saying, "If a ship's path looks weird compared to 99% of other ships, it must be an anomaly." But this is like saying a car is dangerous just because it's driving on a dirt road when everyone else is on pavement. Sometimes, driving on dirt is perfectly fine!
The other old way: Experts manually label the data. But this is slow, expensive, and different experts might disagree on what counts as "dangerous."

The Solution:
This paper proposes a new way to teach computers how to spot danger. Instead of guessing or asking humans to label everything, they created a rule-based system (like a math textbook) to invent fake "dangerous" scenarios. They then use a smart AI (a Large Language Model) to help decide where to put these fake dangers so they look realistic.

The Three Types of "Bad Driving"

The authors created a specific checklist of three things that count as a maritime anomaly. Think of these as three different ways a ship can get into trouble:

The "Ghost Jump" (Unexpected AIS Activity):
- What it is: The ship's GPS suddenly jumps 5 miles to the left, but the ship didn't actually turn or speed up. It's like your phone GPS suddenly saying you are in a different city, even though you are still sitting in your chair.
- The Fix: The system creates fake "jumps" in the data where the ship's position changes wildly, but its speed and direction stay normal.
The "Sudden U-Turn" (Route Deviation):
- What it is: The ship suddenly swerves hard or speeds up/slow down in a way that doesn't make sense for its journey. It's like a car suddenly spinning in circles in the middle of a highway.
- The Fix: The system creates fake scenarios where the ship's speed and direction change abruptly, then slowly corrects itself back to the normal path.
The "Near Miss" (Close Approach):
- What it is: This is the most dangerous one. It's when two ships get dangerously close to each other, like two cars almost crashing at an intersection.
- The Fix: Since real "near misses" are rare in the data, the system invents a "ghost ship." It takes a real ship's path and creates a second, fake ship that drives right next to it, simulating a near-collision.

How They Did It: The "Score-Synthesize-Label" Pipeline

The authors built a three-step factory to create these training examples:

The "Smart Scout" (LLM Scorer):
They used a Large Language Model (like a very smart chatbot) not to write the data, but to act as a scout. They asked the scout: "Looking at this normal ship path, where would it make the most sense to inject a weird event?"
- Analogy: Imagine a director asking a scriptwriter, "Where in this scene should the explosion happen to make the most dramatic sense?" The writer doesn't build the explosion; they just point to the spot.
The "Math Builder" (Equation-Grounded Synthesizer):
Once the scout points to a spot, a strict set of math equations takes over. These equations ensure the fake danger follows the laws of physics.
- Analogy: If the scout says "put a jump here," the math builder ensures the jump is exactly the right size so it doesn't look like magic, but like a sensor glitch.
The "Labeler":
The system automatically marks the exact moment the fake danger happened. Now, the computer has a dataset of "Normal" vs. "Fake Danger" with perfect labels.

What They Found (The Results)

They tested many different computer models (some old, some new) to see which ones could spot these fake dangers.

The "Ghost Jumps" (Type 1) are the hardest: Because the ship didn't actually move or change speed, only the location changed. Most models struggled to tell the difference between a real sensor glitch and normal noise.
The "Sudden U-Turns" (Type 2) are easier: Because the ship's speed and direction actually changed, the models could easily spot the pattern.
The "Near Misses" (Type 3) are tricky: To spot two ships almost crashing, the computer needs to look at two ships at once. Models that only looked at one ship at a time failed. However, when they fed the model data about both ships (the real one and the fake one), the detection got much better.

The Bottom Line

This paper didn't just find a better model; it changed the rules of the game.

Old Rule: "If it looks rare, it's bad." (Often wrong).
New Rule: "If it breaks the physics or safety rules we defined, it's bad." (More accurate).

They created a standard "test drive" for maritime safety systems. Now, instead of guessing if a model is good, we can test it against these specific, mathematically defined dangers to see if it can actually spot a "Ghost Jump," a "Sudden U-Turn," or a "Near Miss."

In short: They built a simulator that creates realistic "what-if" disaster scenarios so computers can learn to spot real dangers before they happen.

Technical Summary: Redefining Maritime Anomaly Detection via Equation-Grounded Synthetic Anomalies

Problem Statement
Maritime anomaly detection is critical for safety and traffic management, relying heavily on Automatic Identification System (AIS) data. However, a fundamental bottleneck exists: publicly available AIS datasets lack predefined anomaly labels. Prior research has attempted to address this through two primary, yet flawed, paradigms:

Distribution-based rarity: Defining anomalies as statistical outliers. This often fails to capture practically critical events (e.g., near-miss encounters) because statistical rarity does not equate to real-world danger.
Expert-based labeling: Relying on domain rules or manual expert annotation. This approach is costly, subjective, difficult to scale, and often overlooks interaction-driven hazards between vessels.

Consequently, existing evaluation processes are arbitrary, and detection models struggle to generalize to operationally meaningful hazards.

Methodology
The authors propose a unified score–synthesize–label pipeline that generates a reproducible, equation-grounded benchmark dataset. The core innovation is an equation-grounded anomaly taxonomy that formalizes maritime domain knowledge into three distinct, operationalizable types:

Unexpected AIS Activity (A1): A single-vessel anomaly representing sensor-induced positional discontinuities (spikes in latitude/longitude) without corresponding kinematic changes (Speed Over Ground - SOG, Course Over Ground - COG).
Route Deviation (A2): A single-vessel anomaly characterized by abrupt, kinematic-driven maneuvers (abnormal SOG/COG variations) that propagate over consecutive timestamps.
Close Approach (A3): An inter-vessel anomaly representing a near-miss event. This is synthesized by constructing a virtual "target ship" trajectory relative to an observed "own ship," creating a pairwise interaction that increases collision risk within a specific temporal window.

The Synthesis Framework
The pipeline employs a Large Language Model (LLM), specifically Qwen3-8B, not as a direct generator of trajectory coordinates, but as a constrained plausibility scorer.

Scoring: The LLM analyzes a trajectory segment and its kinematic statistics to output a per-timestamp plausibility score ( $a_t \in [0, 1]$ ) indicating where an anomaly could semantically fit.
Synthesis: An equation-grounded synthesizer uses these scores to deterministically inject anomalies.
- For A1, it displaces position points perpendicular to the trajectory path based on a scaling factor derived from the score and the trajectory's noise level (Perpendicular Euclidean Distance).
- For A2, it recursively perturbs SOG and COG values over a temporal window, ensuring the vessel eventually recovers to its original route.
- For A3, it constructs a virtual vessel trajectory with a lateral offset and relative velocity designed to satisfy Closest Point of Approach (CPA) and Distance to CPA (DCPA) constraints defined by maritime regulations (COLREGs).
Labeling: Binary labels are assigned at the timestamp level based on the injection windows defined by the equations, ensuring ground truth is mathematically rigorous rather than heuristic.

Key Contributions

Equation-Grounded Taxonomy: The paper formalizes maritime anomalies into three distinct types (A1, A2, A3), distinguishing between single-vessel and interaction-driven events, and provides mathematical definitions for each.
Unified Pipeline: It introduces a score–synthesize–label framework where an LLM acts as a semantic guide for anomaly placement, while the actual generation and labeling are strictly governed by domain equations. This ensures kinematic consistency and reproducibility.
Standardized Benchmark: The authors construct a benchmark on the public OMTAD dataset (cargo and tanker tracks) and evaluate a broad range of models, including traditional detectors, dedicated time-series anomaly detectors, and forecasting models adapted for anomaly detection.

Experimental Results
The authors evaluated 15+ baseline models (e.g., LSTM, Transformers, Anomaly Transformer, OmniAnomaly) across varying window lengths ( $T=12, 24$ ) and anomaly ratios (1%–10%).

A1 (Position Spikes): Detection is extremely difficult. Forecasting-based models (e.g., Informer, VanillaTransformer) slightly outperform others, but AUROC scores remain near random (approx. 54%), indicating that position-only spikes without kinematic changes are a fundamental challenge for current architectures.
A2 (Route Deviation): Performance improves significantly (AUROC > 90% for top models). Kinematic deviations provide clearer discriminative cues. Forecasting models excel at $T=12$ , while probabilistic reconstruction models (OmniAnomaly) perform better at $T=24$ .
A3 (Close Approach): Performance falls between A1 and A2. Detection relies on modeling pairwise relative motion. Standard single-trajectory models struggle, but models explicitly encoding pairwise interactions (e.g., STGVAD with difference inputs) show substantial gains, confirming that interaction-driven anomalies require relational reasoning.
Comparison to Sparsity: The study demonstrates that equation-grounded anomalies are not captured by sparsity-based selection methods. Even with high selection proportions, sparsity-based methods fail to recover a significant portion of the physically meaningful anomalies defined by the taxonomy.

Significance and Claims
The paper claims to be among the first to systematically formalize maritime domain knowledge into an equation-grounded taxonomy and utilize an LLM as a constrained scorer for generating kinematically consistent synthetic anomalies.

Shift in Paradigm: The work argues that effective anomaly detection requires labels rooted in domain knowledge rather than statistical rarity.
Evaluation Rigor: It provides a systematic basis for evaluating detection methods across different anomaly types, revealing that model performance is heavily dependent on the alignment between a model's inductive bias and the specific nature of the anomaly (e.g., position-only vs. kinematic vs. interaction).
Future Direction: The results motivate the development of interaction-aware detection architectures, as single-trajectory representations are insufficient for detecting near-miss events.

The authors maintain a modest stance, acknowledging that their framework covers a restricted subset of formalizable anomalies and that the LLM scorer's outputs are influenced by prompt design and dataset priors. The primary contribution is the provision of a reproducible, expandable labeling framework and a standardized benchmark to advance the field beyond arbitrary, sparsity-based evaluations.